1

Food Safety Modernization Act: Intentional Adulteration Rule

Requirements

Food and Drug AdministrationFood Defense and Emergency Coordination Staff

22

• IA Rule Overview• Vulnerability Assessment Overview• Key Activity Types as a VA Method• Mitigation Strategies• Guidance• Inspection/Compliance• Training

Outline

33

BackgroundMitigation Strategies to Protect Food Against

Intentional Adulteration• Last of 7 foundational rules under Food Safety

Modernization Act• Final rule publication date: May 27, 2016

www.fda.gov

44

What Does the IA Rule Do?• Establishes requirements to prevent or

significantly minimize acts intended to cause wide-scale public health harm

• Uses a HACCP-type approach, with important differences from the Preventive Controls for Human Food rule

• Is risk-based and flexible

www.fda.gov

55

Who is Covered by the IA Rule?• Facilities that manufacture, process, pack or

hold human food• In general, facilities required to register with

FDA under sec. 415 of the FD&C Act– Not farms or retail food establishments

• Applies to domestic and imported food• Some exemptions and modified requirements

apply

66

Exemptions• Very small businesses*

• Holding of food, except holding of food in liquid storage tanks

• Packing, repacking, labeling, or relabeling of food where the container that directly contacts the food remains intact

• Activities of a farm subject to the Produce Safety Rule

• Manufacturing, processing, packing, or holding food for animals

• Alcoholic beverages at certain facilities (under specified conditions)

• On-farm manufacturing/processing, packing, or holding by a small or very small business, of eggs (in-shell, other than RACs) or certain types of game meats, if such activities are the only activities conducted by the business subject to section 418 of the FD&C Act

www.fda.gov

77

What Is Required?• Food defense plan– Vulnerability assessment– Mitigation strategies– Procedures for food defense monitoring– Food defense corrective action procedures– Food defense verification procedures

• Training• Reanalysis • Recordswww.fda.gov

88

Compliance Dates• Very small businesses: Five years (July 26, 2021)

• Small businesses (a business with fewer than 500 full-time equivalent employees): Four years (July 27, 2020)

• All other businesses: Three years (July 26, 2019)

www.fda.gov

9

Vulnerability Assessment Requirement

10

Key Terms• Vulnerability – means the susceptibility of a point, step,

or procedure in a facility’s food process to IA• Significant Vulnerability – means a vulnerability that, if

exploited, could reasonably be expected to cause wide scale public health harm. A SV is identified by a vulnerability assessment.

• Actionable Process Step – a point, step, or procedure in a food process where a significant vulnerability exists

1111

Food Defense Plan – Vulnerability Assessment

• Identification of those points at highest risk, i.e., actionable process steps

• For each point, step, or procedure, a facility must consider, at a minimum:– Potential public health impact – Degree of physical access to product– Ability of an attacker to successfully contaminate the product

1212

Food Defense Plan – Vulnerability Assessment

• Must consider the possibility of an inside attacker

• Outcome of assessment must be written• Key Activity Types are considered an

appropriate method to conduct a vulnerability assessment

13

Key Activity Types

1414

• HSPD-9 requires FDA to conduct vulnerability

assessments of the food system and identify mitigation

strategies (issued Jan 2004)

• FDA has conducted assessments on a wide variety of

products/processes including:

– Manufactured food products & processes

– Retail (Grocery Store & Retail Food Service)

– Transportation & Distribution

– Concessions & Catering

• Form the foundation of FDA’s food defense program

– Tools, training, resources, guidance and IA rule are informed by

vulnerability assessments

FDA Vulnerability Assessments

1515

Identification of Key Activity Types

• FDA food defense VA data analysis shows– Certain processing steps repeatedly ranked high

across VAs, regardless of food• “It is not the food that is vulnerable, it is what we do to the

food that makes it vulnerable” – R. Newkirk

– Focus on the activity being conducted at high ranking processing steps

– Common vulnerabilities can be organized into generalized activity groups

= FDA Identified Key Activity Types

1616

Key Activity TypesI. Bulk Liquid Receiving

and Loading II. Liquid Storage and

HandlingIII. Secondary Ingredient

HandlingIV. Mixing and Similar

Activities

• High volume of food (Element 1)

• Increased access (Element 2)

• Increased vulnerability (Element 3)

17

Key Activity Types as a Vulnerability Assessment Method

18

I. Bulk Liquid Receiving and Loading

II. Liquid Storage and Handling

III. Secondary Ingredient Handling

IV. Mixing and Similar ActivitiesFor illustrative purposes only. Courtesy of the Food Safety Preventive Controls Alliance. Used with permission.

19

Mitigation Strategies Requirement

20

Key Terms• Mitigation Strategies – mean those risk-based,

reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis.

2121

Requirements for Mitigation Strategies

• Mitigation Strategies must exist for each Actionable Process Step

• Must be identified and written in the food defense plan

• Must include an explanation of how the mitigation strategy(ies) sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step

2222

Mitigation Strategies• Based on our vulnerability assessments, we

believe that adequate mitigation strategies will be designed to address

Element 2: Degree of physical access to the product• Locks on hatches• Restrict access to only a

limited number of authorized personnel

• Gates, rails, seals, shields, and other barriers

Element 3: The ability of an attacker to successfully contaminate the product• Increased observation• Peer monitoring

• Mitigation Strategies Database can support facility identification of mitigation strategies

2323

Flexibility for Mitigation Strategies• Facilities have flexibility to identify and

implement mitigation strategies that are most appropriate for the circumstances– Tailored to existing facility practices and procedures– Designed to address the unique nature of the

significant vulnerability– Existing facility-wide security measures or other

practices may be foundational to a mitigation strategy

– Existing measures may already be serving as mitigation strategies - document in food defense plan

2424

Mitigation Strategies Explanation• Mitigation Strategies must have an explanation in

the food defense plan for how the strategy is protective of the actionable process step– Can be straight forward and simple, common sense– Will facilitate common understanding with inspectors– Can inform the development of mitigation strategies

management components– Integral to the determination of proper and

consistent implementation

2525

Guidance• Vulnerability assessment• Mitigation strategies• Food defense monitoring, corrective actions,

and verification• Recordkeeping• A Small Entity Compliance Guide to assist

small and very small businesses to comply with the rule – published Aug. 2017

26

Inspection/Compliance Update

2727

Inspection Framework Approach• Two-Level Inspectional Approach*

– Food Defense Plan Quick-Check• Conducted on all covered facilities• Very low burden on agency and industry• Very little required training for investigators

– Food Defense Inspection• Conducted only on a limited number of prioritized facilities• Focus inspectional resources on were IA risk is highest• Specialized training for investigators

– Rolled out in a staged implementation timeline• Build food defense expertise of regulators and industry*beginning when relevant compliance dates pass

2828

Notional Implementation Timeline

Food Defense Inspections (Initial Phase)

COMPLIANCE GRACE PERIOD

Final IA RuleMay 27, 2016

July 27, 2020 - Food Defense Plan Quick-Check (Small Firms)

July 26, 2019 - Food Defense Plan Quick-Check (Large Firms)

Facility Food Defense Inspection Workplanning

Food Defense Inspections

STAGE 3

Facility prioritization method development

Guidance development, outreach, and education

STAGE 1 STAGE 2

Food Defense Plan Quick-Check continues for all firms

29

Training Update

30

Role of Individual Method of Training – Current thinking and subject to change

Individuals assigned to an actionable process step (including temporary and seasonal personnel)

Online course – Food Defense Awareness

Supervisors of those individuals assigned to an actionable process step (including temporary and seasonal personnel)

Online course – Food Defense Awareness

Individual(s) conducting or overseeing:• the preparation of the food defense

plan

Online course – Food Defense Plan Preparation

Individual(s) conducting or overseeing:• the vulnerability assessment

In-person one day training – Conducting Vulnerability Assessments

Individual(s) conducting or overseeing:• the vulnerability assessment using

only Key Activity Types

Online course – Key Activity Types

Individual(s) conducting or overseeing:• the identification and explanation of

mitigation strategies

Online course – Mitigation Strategies

Individual(s) conducting or overseeing:• Reanalysis

Online course – Reanalysis

31

FDA Food Defense Tools & Resources